201206261305 vna6y
explained decrypted filler
3DES(name) ECB, 22 GUIDs, seed 658
From the post to its content
As posted (encrypted)
B6A0BB3AB5D55A7D 97208DCE47413CE2 B864F2CD6F7B18D9 F01EBFD85F8906E8 9D7C05EF8157708D 2DE53A4234D6D39F FEE7455513EC678B AF2C7B3037D7BC88 857E5F686A787427 9DDB3390AB621272 B3BBD6D5AC89CD9B A79B80920FE806ED 674F959CFADB22CC 10C2C40C2975C406 5DEEA1A4C5A5B2CD DD4B17DDD83C910F 9F512A3C46FCD59C 9EF5E42AA7BAD70A 3D8EB05A4D3D18A2 D079CBA392F9A3B1 18121A44CE2A5730 3364F90371D31B11 F50340C99C9D4503 5304512359E66C32 7D60D1BCCB37047E 151F5E44C20A4AE6 18BC80C4827B621C 155600891C9F5F69 DF6BB348B8560C0C CB0B504863E81EE6 598D34E4767A14D9 4F653097F9D11B2B 045B86843EB55001 EA472BEFBAE8344C 55450C4762759654 5469549B0E70DAAC 12CCB061496F3D64 9A6E4AF04AD10E8E 36B246A20051B9E8 95F7654792F8A146 273AD7BC5D1C702E 8A7B6D9B5B03C6C4 97995768EC4DFBA3 39FF0CCE84D78D13 E9A380F044EF12E0 6F6EF77B27686356 D7D09D5FE71F10FB 4A93FA4A9C019585 761771DEFB11D0A4 1F56A4F9669739DA 352509B4DCBCB8A7 EB2A47CB88979560 8743091B06005283 03E5E789DCCE7652 0999ABF9F9D49630 DD32B3597CDD7B29 B9A2C7911ED41F4A B7C25E8277EA2FFF 2D723FF2D4BD2105 1C0DEB057D6F9618 6F2A17DE40D86690 648176A9DAF8FFCD F1D80C35FE530952 FC1C505A654A4F37 3DDC590909E5D2D7 6FE0A61856A6EE78 67F713D4477C1A4E 8BEACA4B3DD7E5A4 66B7E2BC0F940363 47462DF089B8D85C 83D2E139E314A0A8 EA45382B242CDA14 6CCB716F1E93BF6C 2CA08C6A313B7F71 ED3A2D06BA174FFF 093D4BB73BB5789B DCC4FA6CFF464731 B48BB97EB0951C23 7A2FFE660CF811BE 9D9BB56FBB7597AA FE4C50958DD55193 2AFA64331E459DC0 1135917655E14D8D FEFA99ABEEB9BE51 2E3C084DE453042D 227EA5331D3E737C 037FB67789085E4C 33F7AD19E3B018F9 5DACFFBA8FF64DBD
- Read the ciphertext. Strip whitespace: 1,424 hex characters = 712 bytes = 89 8-byte 3DES blocks.
- Derive the key. Password =
A858DE45F56D9BC9(name). Key = MD5(password) =34a14a42e98ff96095af56604e290cae, used as a two-key 3DES key. - Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 22 GUIDs as hex (shown below).
Decrypted: GUID list
1 ccef4fac-59e0-4faf-b089-1c50a2edc935 2 e6c99d89-7df0-70a3-9ef9-44b7b62e40a9 3 af834f1c-b366-6d5a-9e42-60b4aab23b8b 4 1c5b3581-9c7c-06fe-862a-741f1ff86d09 5 003f55d1-9255-209d-971a-fd1d59a66d23 6 5b3b7f68-44c9-53aa-ab4e-9fbaa07405b3 7 efceca67-cdfa-692f-a8be-d44bafd998a6 8 77f7c892-196e-4650-9c60-c826cc3786a9 9 f0d6f508-de67-304e-80c0-f9b47a6f86fc 10 4ec604c1-85b7-8ea5-963e-6b1d70e97f89 11 cbb6a32d-2ee2-0bc0-abef-55980478f9ed 12 03245f34-506c-19ff-8eb5-271143ad7a28 13 26696c4c-3988-8259-a90e-90c6704bf870 14 7afbcb27-5860-743e-b16f-4f3df4ad7c1a 15 a4f5259b-1bbb-5c71-b6e5-9f1258581ec3 16 152d5fca-92fb-87e3-8175-1389d25008c2 17 0fe8aa47-d40a-4d3b-8eec-2a78b2d56bff 18 7a2c45e1-dab2-847f-88bf-49939a5e911d 19 9296ed9c-1a6e-4e2c-ad68-5edee45079ca 20 bc2d29f8-dffc-0e06-907b-407bd2f50fe8 21 7489849d-d162-268a-821a-bddc0f7d2ef4 22 6cc8ced4-1926-2e27-853b-ce5a2884ca94
Explanation
- Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives
4760256438018758484022. Exactly this sequence comes out ofnew Random(658).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID areGuid.NewGuid()output and carry no message. - Explain the count. This post is draw 3 of Run 4 (seed 664,106,302):
new Random(664106302), Next(8,24) per post. The RNG predicts N = 22; the post has N = 22 ✓. The seed is the machine's uptime in ms when the app started (boot F 2012-05-15 19:07–19:12). - Conclusion. Filler. The content is fully explained by the two RNGs.